179 matches found
Iranian Government-Sponsored APT Actors Compromise Federal Network, Deploy Crypto Miner, Credential Harvester
Summary From mid-June through mid-July 2022, CISA conducted an incident response engagement at a Federal Civilian Executive Branch FCEB organization where CISA observed suspected advanced persistent threat APT activity. In the course of incident response activities, CISA determined that cyber...
The art and science behind Microsoft threat hunting: Part 2
We discussed Microsoft Detection and Response Team’s DART threat hunting principles in part 1 of The art and science behind Microsoft threat hunting blog series. In this follow-up post, we will talk about some general hunting strategies, frameworks, tools, and how Microsoft incident responders wo...
Threat Roundup for September 9 to September 16
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Sept. 9 and Sept. 16. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristic...
SuiteCRM authenticated SQL injection in export functionality
This module exploits an authenticated SQL injection in SuiteCRM in versions before 7.12.6. The vulnerability allows an authenticated attacker to send specially crafted requests to the export entry point of the application in order to retrieve all the usernames and their associated password from t...
Threat Roundup for July 29 to August 5
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between July 29 and Aug. 5. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics,...
Exploit for CVE-2022-30190
MSDTCVE-2022-30190 This Repository Talks about the Follina MS...
Lupo - Malware IOC Extractor. Debugging Module For Malware Analysis Automation
Debugging module for Malware Analysis Automation For a step by step post on how to use Lupo, with images and instructions, please see this post: https://medium.com/@vishalthakur/lupo-malware-ioc-extractor-cc86ae76b85d Introduction Working on security incidents that involve malware, we come across...
Hive Ransomware targets organizations with ProxyShell exploit
THREAT LEVEL: Red. For a detailed advisory, download the pdf file here Hive Ransomware has been active since its discovery in June 2021, and it is constantly deploying different backdoors, including the Cobalt Strike beacon, on Microsoft Exchange servers that are vulnerable to ProxyShell...
MDR Plus Threat Intel: 414 New Detections in 251 Days (You’re Welcome)
Last summer, Rapid7 acquired IntSights and its advanced external threat intelligence solution now Threat Command by Rapid7. Threat Command monitors hundreds of thousands of sources across the clear, deep, and dark web, identifying malicious actors and notifying customers of potential attacks...
ALLMediaServer 1.6 Buffer Overflow Exploit
This Metasploit module exploits a stack buffer overflow in ALLMediaServer version 1.6. The vulnerability is caused due to a boundary error within the handling of HTTP request. This module requires Metasploit: https://metasploit.com/download Current source:...
Odin - Central IoC Scanner Based On Loki
Odin is a central IoC scanner based on Loki General Info This application Loki latest version and download it on all machines using a powershell script and run it then this app receives the respose from all machines and parse the feed in CSV form. Requirements 1. Python +3.5 2. PyQT5 3. psutil 4...
Threat advisory: Cybercriminals compromise users with malware disguised as pro-Ukraine cyber tools
Update March 12, 2022: Cisco Talos has updated the IOC section with additional hashes. Executive summary Opportunistic cybercriminals are attempting to exploit Ukrainian sympathizers by offering malware purporting to be offensive cyber tools to target Russian entities. Once downloaded, these...
IOCs
//////////////// ////////////////////// //...
Exploit for Uncontrolled Resource Consumption in Siemens 6Bk1602-0Aa12-0Tp0_Firmware
l4j-info Compiling valuable links as I find them documenting C...
Exploit for Uncontrolled Resource Consumption in Siemens 6Bk1602-0Aa12-0Tp0_Firmware
Log4Shell CVE-2021-44228 related attack IOCs The source IP...
Exploit for Uncontrolled Resource Consumption in Siemens 6Bk1602-0Aa12-0Tp0_Firmware
log4j log4shell CVE-2021-44228 Public IoCs list Public IoCs...
com.github.marcelop3251:queues-manager (=1.2.0), net.oneandone.ioc-unit:ioc-unit-jms-rabbitmq (>=2.0.28 <=2.0.40) potentially affected by CVE-2020-36282 via com.rabbitmq.jms:rabbitmq-jms (=1.14.0)
com.rabbitmq.jms:rabbitmq-jms MAVEN version =1.14.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq.jms:rabbitmq-jms and may be impacted: - com.github.marcelop3251:queues-manager =1.2.0 - net.oneandone.ioc-unit:ioc-unit-jms-rabbitmq =2.0.2...
Gotanda - Browser Web Extension For OSINT
Gotanda is OSINTOpen Source Intelligence Web Extension for Firefox/Chrome. This Web Extension could search OSINT information from some IOC in web page.IP,Domain,URL,SNS...etc This Repository partly the studying and JavaScript practice. Download link below. FireFox Chrome Usage Right click...
BlackMatter Ransomware Analysis; The Dark Side Returns
ARCHIVED STORY BlackMatter Ransomware Analysis; The Dark Side Returns By Alexandre Mundo and Marc Elias · September 22, 2021 BlackMatter is a new ransomware threat discovered at the end of July 2021. This malware started with a strong group of attacks and some advertising from its developers that...
